CVE-2010-2762: mozilla firefox

Modified

Published 09-09-2010Last modified 07-08-2024

Vulnerability summary

CVE-2010-2762 is a medium (CVSS 6.8) vulnerability in mozilla firefox. EPSS estimates a 2.02% chance of exploitation in the next 30 days, higher than 81% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

2.02%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 3

OPENSUSE-SU-2024:10071-1 OPENSUSE-SU-2024:10230-1 OPENSUSE-SU-2024:14572-1 RHSA-2010:0681

Timeline

09-09-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

2.02%

Chance of exploitation in the next 30 days

Percentile

81%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.02% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Mozilla2 products

firefox3.6 | 3.6.2 | 3.6.3 | 3.6.4 | 3.6.6 | 3.6.7 | 3.6.8
thunderbird3.1 | 3.1.1 | 31.2

1 vendor · 2 products

References

12 links

bugzilla.mozilla.org/show_bug.cgi?id=584180X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.htmlVendor AdvisoryX Refsource SUSE
blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefoxX Refsource CONFIRM
support.avaya.com/css/P8/documents/100112690X Refsource CONFIRM
secunia.com/advisories/42867Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2011/0061VDB EntryX Refsource VUPEN
www.mozilla.org/security/announce/2010/mfsa2010-59.htmlX Refsource CONFIRMVendor Advisory
www.mandriva.com/security/advisories?name=MDVSA-2010:173Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2010/2323VDB EntryX Refsource VUPEN
exchange.xforce.ibmcloud.com/vulnerabilities/61656VDB EntryX Refsource XF

Show all 12 references

www.securityfocus.com/bid/43092VDB EntryX Refsource BID
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11492VDB EntrySignatureX Refsource OVAL